Maybe move the complete lookup of the certificate to the descriptor method